Overview

overview

10

Static

static

10

anti-anti-afk.exe

windows10-ltsc_2021-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    anti-anti-afk.exe

  • Size

    1.6MB

  • Sample

    250413-dv47yaxzfv

  • MD5

    65aa3c881c733d7dddb867f4df56c316

  • SHA1

    568313bc4a3eaba39da891becee3b752cec87337

  • SHA256

    02d23f91859aa28a823d9b082129137836289a5bb11bae498689515a22072b16

  • SHA512

    adaac864a3c834bd7bd48093d4f84e84117606cf154516292afb79bfad2ebfe80938ee88f2fff1b34fe3e17fe0305ffacd5d7132c8e1c12e0f69df05e182a2d2

  • SSDEEP

    49152:aMfQfiZ7q/ruyE3SSY0wYkZvUwORp/sc:aMfT/iiYvUwOd

Score
10/10
quasarrevengeratcoltdiscoveryspywarestealertrojan

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

colt

C2

66.113.31.17:7547

Mutex

KYS-INF&G^TT*^N

Attributes
  • encryption_key

    70241AEB531B22CC4A2F1CDAD4B909EAB6831EBD

  • install_name

    svchost.exe

  • log_directory

    colt logs

  • reconnect_delay

    100

  • startup_key

    svchost.exe

  • subdirectory

    rundll32

Targets

    • Target

      anti-anti-afk.exe

    • Size

      1.6MB

    • MD5

      65aa3c881c733d7dddb867f4df56c316

    • SHA1

      568313bc4a3eaba39da891becee3b752cec87337

    • SHA256

      02d23f91859aa28a823d9b082129137836289a5bb11bae498689515a22072b16

    • SHA512

      adaac864a3c834bd7bd48093d4f84e84117606cf154516292afb79bfad2ebfe80938ee88f2fff1b34fe3e17fe0305ffacd5d7132c8e1c12e0f69df05e182a2d2

    • SSDEEP

      49152:aMfQfiZ7q/ruyE3SSY0wYkZvUwORp/sc:aMfT/iiYvUwOd

    Score
    10/10
    quasarrevengeratcoltdiscoveryspywarestealertrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Revengerat family

      revengerat

    • RevengeRat Executable

      stealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks